Network Protocols Analyzers: Ethereal

1. Ethereal.  Ethereal can recognize a number of protocols that has a graphical-user-interface, which allows you to analyze captured traffic much easier then TCPDump.  Ethereal displays traffic information using three windows.  The top window shows the summary of the captured packets. The details of packet headers can be viewed from the middle window and the bottom window shows packet content in hexadecimal and ASCII representation. The following steps show how you can capture and view the content of the packets.

1. On PC1, run the ethereal command by using the following command.  

$ sudo ethereal

2. To set the capture filters, on the menu bar click Capture then Start.

Select eth0 in Interface.
Select Capture packets in promiscuous mode.
In Filter, type host192.168.30.51 and host
Select Update list of packets in real time.
Select Automatic scrolling in live capture. -Unselect three Enable name resolution checkboxes and click OK. 

3. Open a terminal window on PC1, initiate an FTP session to PC2 using the same process as step 5 from TCPDump.  Transfer a file and quit the FTP session.

4. On the ethereal top window, select any TCP packet. Right-click that line and then select Follow TCP Stream.

What do you see? Write down only the lines related to username and password exactly as they are shown. What is the filter expression at the bottom of the ethereal window, next to the label filter?  This is also called the dispaly filter since only the traffic that matches the expression is displayed. 

5. To write your own display filter, press the Reset button to remove the existing filter. Then type a filter expression in the field and press Enter. You can use an interactive help-window for writing display filters. The following example will show you how to write a display filter to display TCP headers with the SYN flag set.

Click the Filter button or click Edit on the menu bar, and then select Display Filters.
On the pop-up window, click Add Expression, then select TCP: Syn
Select = = in Relation
Set the value (Boolean) to 1
Click Accept and the filter string will be shown.
Your filter string: _____________________________
Then click Close.

6. Press the Reset button on the bottom. Type the filter expression obtained in step 6, and then press Enter.

2.  Questions.

1. How many TCP headers with SYN flag set are shown in the window?

2. Write syntax for the following display filters.

a.  A display filter that shows IP datagrams with the source IP address of PC2.
b.  A display filter that shows packets containing TCP segments using the destination port 23.
c.  A display filter that shows IP datagrams with length greater than 400 bytes.